BREAKING NEWS: 14 million attacks per hour and rising!

A MASSIVE distributed brute force attack campaign aimed only at WordPress sites started THIS MORNING at3 AM UTC(Coordinated Universal Time),(3 AM United Kingdom, England;4 AM Germany; 5 AM Romania). It uses a large number of attacking IPs, and each IP is generating a huge number of attacks. This is the most aggressive campaign ever reported, peaking at over 14 million attacks per hour. This brute force attack CONTINUES to ramp up in volume during the past hour as we publish this post.

What we know at this time:

Peak point of the attack: 14.1 million per hour.

IPs involved: 10,000+.

Individual WordPress targeted: 190,000 per hour.

This is the most aggressive campaign by hourly attack volume.

A possible explanation This new massively increasing brute force attack can be the testing of the credential pairs (username+password) dumped on Dark Web on DEC 5, a few days ago, in an underground community forum. The database was recently updated with the last set of data inserted on 11/29/2017. The total amount of credentials (usernames/clear text password pairs) is 1,400,553,869.

Monitor successfull logins for ALL administrator accounts on your website.

Do not reuse a password on multiple services!

Spread the Word among the WordPress community to create awareness of this new threat. Share this post on ALL your social media channels (use the links from the bottom bar); warn your friends and relatives. Righ now!

Related Posts

For your WordPress protection, be informed about the latest WordPress Core vulnerabilities, fixed in WordPress 4.9.5 Security and Maintenance Release from April 3, 2018. WordPress versions 4.9.4 and earlier are affected by three security issues. As part of the core team's ongoing commitment to security hardening, the following fixes have...

If you are unable to login to your WordPress site, then there is a chance that hackers may have compromised your admin account from WordPress. There are some common tell-tale signs that should help you figure out if your WordPress site is compromised. Don't panic, but this is serious! In...

For your WordPress protection, be informed about the latest WordPress Core vulnerability IS STILL UNPATCHED since it's first official report January 29, 2018 or it's official disclosure date: Monday, February 5, 2018. All versions of WordPress starting with the latest 4.9.5 and below have the Application Denial of Service (DoS)...

With so many bad news of vulnerabilities and hackers attempting to compromise WordPress sites regularly, you start wondering if WordPress is really secure at all. You can stop wondering because WordPress is secure! The popularity numbers create this negative effect. Today, WordPress powers 27% of all sites on the web...

For your WP Security, be informed about the latest vulnerabilities in WordPress plugins: Church Admin Unauthenticated Directory Traversal reported by malwrforensics.com. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software...

For your WP Security, be informed about the latest vulnerabilities in WordPress plugins: Redirection Authenticated Local File Inclusion reported by Ryan (Dewhurst Security). ACE via file inclusion in Redirection allows admins to execute any PHP file in the filesystem. If you are logged in as an administrator on any site...

WordPress 4.9.1 is now available. This is a security and maintenance release for all versions since WordPress 3.7. WordPress versions 4.9 and earlier are affected by 4 security issues which could potentially be exploited as part of a multi-vector attack. As part of the core team's ongoing commitment to security...

Social engineering approaches further matured in both phishing and malware attacks, with increased geotargeted malware attacks. For all the known WordPress Security issues, these were the most identified types: BANKING TROJANS: This type of malware steals victims bank login credentials, usually by redirecting victims’ browser to a fake version of...

For your WordPress protection, be informed about the latest vulnerabilities in WP plugins: WP Statistics SQL injection reported by Sucuri. Exploit allows to create an admin-level user and sign in to your WordPress as an admin. Cross-Site Scripting (XSS) reported by Dewhurst Security. Exploit allows attackers to compromise a WordPress...

WordPress 4.9.2 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files...

For your WP Security, be informed about the latest vulnerabilities in WordPress themes: Supreme Directory Theme Unauthenticated Cross-Site Scripting (XSS) reported by Franciny Salles and Flavio Landivar. This theme has a parameter's, that allows executing an xss payload: "script>alert(0)". The software does not neutralize or incorrectly neutralizes user-controllable input before...

WordPress 4.9.5 is now available. This is a Security and Maintenance Release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. WordPress versions 4.9.4 and earlier are affected by three security issues. As part of the core team's ongoing commitment to security hardening, the...